Repository navigation
chore(deps): bump pnpm/action-setup from 5.0.0 to 6.1.0 - #3014
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 5.0.0 to 6.1.0. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@fc06bc1...ea17c68) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
@modelcontextprotocol/client
@modelcontextprotocol/codemod
@modelcontextprotocol/core
@modelcontextprotocol/server
@modelcontextprotocol/server-legacy
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this PR and didn't find any bugs; because it is a major-version bump of an action used by the publish and release workflows, a quick human look before merging is still worthwhile.
What was reviewed:
- All 11
pnpm/action-setuppins across the six workflows now point at the same SHA with the same# v6.1.0comment; no stale v5 pin remains in.github/. - The SHA-to-tag correspondence could not be verified from this offline checkout, so the
# v6.1.0comment is taken from the dependabot description rather than confirmed. - The root
package.json:18pinspackageManager: pnpm@ 10.26.1and the four test sub-packages pinpnpm@ 10.24.0, so the action's bundled pnpm 11/12 default does not change the pnpm version CI actually runs;run_install: falseis unchanged everywhere.
Extended reasoning...
The change is a dependabot bump of pnpm/action-setup from a v5.0.0 commit pin to a v6.1.0 commit pin in eleven identical one-line substitutions across .github/workflows/conformance.yml, deploy-docs.yml, examples.yml, main.yml, publish.yml and release.yml, with no source, test or package changes. It touches no injection, auth or data-exposure surface, but the publish and release workflows are the repo's supply-chain path to npm, and a third-party action SHA is being swapped there. The bump is mechanical and consistent, and the packageManager pins in package.json keep the resolved pnpm version unchanged; what keeps this at defer rather than approve is that the new SHA's correspondence to the v6.1.0 tag cannot be verified offline, it is a major-version jump, and .github/CODEOWNERS assigns every path to the typescript-sdk team.
claude
Bot
added
the
v2
Bumps pnpm/action-setup from 5.0.0 to 6.1.0.
Release notes
Sourced from pnpm/action-setup's releases.
... (truncated)
Commits
ea17c68feat: support pnpm v12 (#288)0977fd9docs: Update README to include devEngines.packageManager (#273)48261acfix: update pnpm to v11.19.0 (#283)75677f7ci: use pnpm 11 forpr-check(#284)769ae71refactor: introduce restore keys for cache (#280)6fed91fdocs(README): point users to the successor pnpm/setup action (#282)0ebf471fix: update pnpm to v11.7.0 (#267)0e279bbfix: update pnpm to 11.1.1 (#248)3e83581fix: drop patchPnpmEnv so standalone+self-update works on Windows (#258)551b42edocs(README): fixcache_dependency_pathtype (#257)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)